Thousands of Websites Load Cryptocurrency Miner After Actors Compromise Third-Party Library

Thousands of websites secretly loaded a cryptocurrency miner that preys upon visitors after cybercriminals compromised a third-party library.

Security researcher Scott Helme reported the incident in a blog post that detailed how unknown actors changed one of the script files hosted by Texthelp, a provider of reading-assistive technology. Those malefactors targeted the Browsealoud web screen reader and altered it to include the CoinHive Monero miner.

“The ba.js had been altered to include a document.write call that added a CoinHive crypto miner to any page it was loaded in to,” Helme explained. In total, he found that the incident affected more than 4,000 websites, including many “prominent government websites” in the U.S. and U.K.

Swift Response

Helme reached out to Texthelp following his discovery, and the technology provider responded by temporarily disabling Browsealoud. It also issued a statement informing customers that it had implemented its “data security action plan” after learning of the issue. Texthelp went on to note that it had removed Browsealoud from all customer sites and mitigated any associated risk within four hours.

The U.K.’s Information Commissioner’s Office (ICO) took down its website Feb. 11 after learning it had been affected. The site remained offline the next day while the ICO investigated the incident.

Preventing Cryptocurrency Miner Attacks

The surge of cryptocurrency miner attacks in recent months calls for domain owners to strengthen the security of their websites. According to Helme, they can protect their sites against this particular attack type by adding the SRI Integrity Attribute, which enables the browser to determine whether a file has been modified. If someone has changed it, the browser won’t load the file.

Domain owners can take their website security one step further by implementing the Content Security Policy and the require-sri-for directive, Helme noted. Together, those measures prevent any script from loading on a hosted webpage without an SRI Integrity Attribute.

David Bisson

Contributing Editor

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Swift Response

Preventing Cryptocurrency Miner Attacks

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates